[jira] [Created] (HDDS-17057) Document S3 signed multi-chunks upload verification behavior and limitations

["Chung-En Lee (Jira)" <ji...@apache.org>]

Chung-En Lee created HDDS-17057:
-----------------------------------

             Summary: Document S3 signed multi-chunks upload verification behavior and limitations
                 Key: HDDS-17057
                 URL: https://issues.apache.org/jira/browse/HDDS-17057
             Project: Apache Ozone
          Issue Type: Sub-task
            Reporter: Chung-En Lee


Draft a comprehensive document/design doc explaining how Apache Ozone handles S3 chunked uploads (signed multi-chunks payload verification), detailing the verification workflows, supported algorithms, and current limitations.


h4. *Key Points to Cover in the Doc*
 # *Verification Conditions & Behavior:*

 ** Clearly document *under which specific circumstances signature verification actually takes place* during chunked uploads (e.g., specific {{x-amz-content-sha256}} header types such as {{{}STREAMING-AWS4-HMAC-SHA256-PAYLOAD{}}}, presence of derived keys, payload vs. trailer verification).

 # *Algorithm Support & ECDSA Limitation:*

 ** *HMAC-SHA256:* Fully supported for chunk payload and trailer signature verification.

 ** *ECDSA (e.g., {{STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD}} / SigV4a):*

 *** *Verification is currently NOT supported.*

 *** *Upload behavior:* Even though Ozone cannot verify ECDSA chunk signatures, *the upload will still succeed* without failing the request (payload is accepted/streamed, but signatures are not verified).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org